Attachment_1_-_Additional_Terms_and_Conditions.pdf

Attachment 1 – Additional Terms and Conditions

XVI. Additional terms and conditions applicable to this requirement.

(1) REPORTING REQUIREMENTS

(a) Reporting and Deliverable Requirements

1. Technical Progress Reports

a. Weekly Progress Reports See Attached Reporting and Deliverable Requirements

b. Final Report

2. Other Reports/Deliverables

a. Final Manual of Operations

b. Information Security and Physical Access Reporting Requirements See Attached Reporting and Deliverable Requirements - ISSO

(2) PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

(3) INSPECTION AND ACCEPTANCE

(a) The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

(b) For the purpose of this SECTION, TBD is the authorized representative of the Contracting

Officer.

(c) Inspection and acceptance will be performed at:

TBD

(d) This contract incorporates the following clause by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available

FAR Clause 52.246-4, Inspection of Services - Fixed Price (August 1996).

(4) DELIVERIES

(a) CONTRACTOR'S PROPOSED DELIVERY SCHEDULE See Attachment 2 – Reporting and Deliverable Requirements

(5) CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract:

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; or (5) otherwise change any terms and conditions of this contract; or

(6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

The Government may unilaterally change the COR designation.

(6) KEY PERSONNEL, HHSAR 352.242-70 (January 2006)

The key personnel specified in this contract are considered to be essential to work performance.

At least 30 days prior to diverting any of the specified individuals to other programs or contracts (or as soon as possible, if an individual must be replaced, for example, as a result of leaving the employ of the Contractor), the Contractor shall notify the Contracting Officer and shall submit comprehensive justification for the diversion or replacement request (including proposed substitutions for key personnel) to permit evaluation by the Government of the impact on performance under this contract. The Contractor shall not divert or otherwise replace any key personnel without the written consent of the Contracting Officer. The Government may modify the contract to add or delete key personnel at the request of the Contractor or Government.

(End of Clause)

The following individual(s) is/are considered to be essential to the work being performed hereunder:

Name Title

TBD TBD

(7) INVOICE SUBMISSION

(a) Invoice Instructions for NIH Fixed-Price Type Contracts, NIH(RC)-2, are attached and made part of this contract. The Contractor shall follow the attached instructions and submission procedures specified below to meet the requirements of a "proper invoice" pursuant to FAR Subpart 32.9, Prompt Payment.

1. Payment requests shall be submitted to the offices identified below. Do not submit supporting documentation (e.g., receipts, time sheets, vendor invoices, etc.) with your payment request unless specified elsewhere in the contract or requested by the Contracting Officer.

a. The original invoice shall be submitted to the following designated billing office:

National Institutes of Health Office of Financial Management Commercial Accounts 2115 East Jefferson Street, Room 4B-432, MSC 8500 Bethesda, MD 20892-8500

b. One copy of the invoice shall be submitted to the following approving official:

Contracting Officer

E-mail:

The Contractor shall submit an electronic copy of the payment request to the approving official instead of a paper copy. The payment request shall be transmitted as an attachment via e-mail to the address listed above in one of the following formats: MSWord, MS Excel, or Adobe Portable Document Format (PDF). Only one payment request shall be submitted per e-mail and the subject line of the e-mail shall include the Contractor's name, contract number, and unique invoice number. [Note:

The original payment request must still be submitted in hard copy and mailed to the designated billing office to meet the requirements of a "proper invoice."]

2. In addition to the requirements specified in FAR 32.905 for a proper invoice, the Contractor shall include the following information on the face page of all payment requests:

a. Name of the Office of Acquisitions. The Office of Acquisitions for this contract is NHLBI Office of Acquisition, COAC Services Branch.

b. Federal Taxpayer Identification Number (TIN). If the Contractor does not have a valid TIN, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, DUNS, or VIN, contact the Contracting Officer.

c. DUNS or DUNS+4 Number. The DUNS number must identify the Contractor's name and address exactly as stated in the contract and as registered in the Central Contractor Registration (CCR) database. If the Contractor does not have a valid DUNS number, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, DUNS, or VIN, contact the Contracting Officer.

d. Invoice Matching Option. This contract requires a two-way match.

e. Unique Invoice Number. Each payment request must be identified by a unique invoice number, which can only be used one time regardless of the number of contracts or orders held by an organization.

f. The Contract Title is: Whole Genome Sequencing and Omics Pilot for NHLBI TOPMed Program

g. Contract Line Items as follows:

Line Item # Line Item Description

TBD TBD

(b) Inquiries regarding payment of invoices shall be directed to the designated billing office,

(301) 496-6088.

(8) PROVIDING ACCELERATED PAYMENT TO SMALL BUSINESS SUBCONTRACTORS, FAR

52.232-40 (December 2013)

(a) Upon receipt of accelerated payments from the Government, the Contractor shall make accelerated payments to its small business subcontractors under this contract, to the maximum extent practicable and prior to when such payment is otherwise required under the applicable contract or subcontract, after receipt of a proper invoice and all other required documentation from the small business subcontractor.

(b) The acceleration of payments under this clause does not provide any new rights under the prompt Payment Act.

(c) Include the substance of this clause, include this paragraph c, in all subcontracts with small business concerns, including subcontracts with small business concerns for the acquisition of commercial items.

(End of Clause)

(9) POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

(a) Contractor Performance Evaluations

Interim and Final evaluations of Contractor performance will be prepared on this contract in accordance with FAR Subpart 42.15. The final performance evaluation will be prepared at the time of completion of work. In addition to the Final evaluation, Interim evaluation(s) will be prepared Annually as follows on TBD.

Interim and Final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation. The Contractor will be permitted thirty days to review the document and to submit additional information or a rebutting statement. If agreement cannot be reached between the parties, the matter will be referred to an individual one level above the Contracting Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as part of the contract file, and may be used to support future award decisions.

(b) Electronic Access to Contractor Performance Evaluations Contractors may access evaluations through a secure Web site for review and comment at the following address: http://www.cpars.gov/main/cparsmain.htm http://www.cpars.gov/main/cparsmain.htm

(10) SUBCONTRACTING PROVISIONS

(a) Small Business Subcontracting Plan

The failure of any Contractor or subcontractor to comply in good faith with FAR Clause 52.219-8, entitled "Utilization of Small Business Concerns" incorporated in this contract and the attached Subcontracting Plan, will be a material breach of such contract or subcontract and subject to the remedies reserved to the Government under FAR Clause 52.219-16 entitled, "Liquidated Damages-Subcontracting Plan."

Subcontracting Reports The Contractor shall submit the following Subcontracting reports electronically via the "electronic Subcontracting Reporting System (eSRS) at http://www.esrs.gov.

Individual Subcontract Reports (ISR) Regardless of the effective date of this contract, the Report is due on the following dates for the entire life of this contract:

April 30th October 30th Expiration Date of Contract

Summary Subcontract Report (SSR) Regardless of the effective date of this contract, the Summary Subcontract Report shall be submitted annually on the following date for the entire life of this contract:

October 30th

For both the Individual and Summary Subcontract Reports, the Contracting Officer shall be included as a contact for notification purposes at the following e-mail address:

(11) INFORMATION AND PHYSICAL ACCESS SECURITY

(a) IMPORTANT NOTE TO OFFERORS: Information and Physical Access Security is applicable to this solicitation and the following information is provided to assist in proposal preparation. The following information shall be addressed in a separate section of the Technical Proposal, entitled “Information Security.”

(b) The Homeland Security Presidential Directive (HSPD)-12 and the Federal Information Security Management Act of 2002 (P.L. 107-347) (FISMA) requires each agency to develop, document, and implement an agency-wide information security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor (including subcontractor), or other source.

(12) INFORMATION AND PHYSICAL ACCESS SECURITY – HHS-Controlled Facilities and

Information Systems Security

(a) To perform the work specified herein, Contractor personnel are expected to have routine (1) physical access to an HHS-controlled facility; (2) physical access to an HHS-controlled information system; (3) access to sensitive HHS data or information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

(b) To gain routine physical access to an HHS-controlled information system, and/or access to sensitive data or information, the Contractor and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; Office of Management and Budget Memorandum (M-http://www.esrs.gov/

05-24); and Federal Information Processing Standards Publication (FIPS PUB) Number 201;

and with the personal identity verification and investigations procedures contained in the following documents:

1. HHS-OCIO Information Systems Security and Privacy Policy

(http://www.hhs.gov/ocio/policy/#Security )

2. HHS HSPD-12 Policy Document, v. 2.0

(http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05- 24.pdf)

3. Information regarding background checks/badges (http://idbadge.nih.gov/background/index.asp)

(c) Position Sensitivity Levels:

This contract will entail the following position sensitivity levels:

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (MBI).

[X] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[ ] Level 1: Non-Sensitive. Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Check and Inquiry Investigation

(NACI).

(d) The personnel investigation procedures for Contractor personnel require that the Contractor prepare and submit background check/investigation forms based on the type of investigation required. The minimum Government investigation for a non-sensitive position is a National Agency Check and Inquiries (NACI) with fingerprinting. More restricted positions - i.e., those above non-sensitive, require more extensive documentation and investigation.

As part of its proposal, and if the anticipated position sensitivity levels are specified in paragraph (c) above, the Offeror shall notify the Contracting Officer of (1) its proposed personnel who will be subject to a background check/investigation and (2) whether any of its proposed personnel who will work under the contract have previously been the subject of national agency checks or background investigations.

Upon award, the Contractor shall submit a roster, by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under the contract who will develop, have the ability to access and/or maintain a Federal Information System(s). The roster shall be submitted to the Contracting Officer's Representative (COR), with a copy to the Contracting Officer, within 14 calendar days after the effective date of the contract. The Contracting Officer shall notify the Contractor of the appropriate level of suitability investigations to be performed. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at: https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10 -15-12.xlsx

Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

The Contractor shall notify the Contracting Officer in advance when any new personnel, who are subject to a background check/investigation, will work under the contract and if they have previously been the subject of national agency checks or background investigations.

http://www.hhs.gov/ocio/policy/%23Security http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf http://idbadge.nih.gov/background/index.asp https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx

All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract.

Contractors may begin work after the fingerprint check has been completed.

(e) Investigations are expensive and may delay performance, regardless of the outcome of the investigation. Delays associated with rejections and consequent re-investigations may not be excusable in accordance with the FAR clause, Excusable Delays - see FAR 52.249-14.

Accordingly, the Contractor shall ensure that any additional employees whose names it submits for work under this contract have a reasonable chance for approval.

(f) Typically, the Government investigates personnel at no cost to the Contractor. However, multiple investigations for the same position may, at the Contracting Officer's discretion, justify reduction(s) in the contract price of no more that the cost of the additional investigation(s). Accordingly, if position sensitivity levels are specified in paragraph (c) above, the Offeror shall ensure that the employees it proposes for work under this contract/order have a reasonable chance for approval.

(g) The Contractor shall include language similar to this "HHS Controlled Facilities and Information Systems Security" language in all subcontracts that require subcontractor personnel to have the same frequency and duration of (1) physical access to an HHS-controlled facility; (2) logical access to an HHS-controlled information system; (3) access to sensitive HHS data/information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

(h) The Contractor shall direct inquiries, including requests for forms and assistance, to the Contracting Officer or designee.

(i) Within 7 calendar days after the Government's final acceptance of the work under this contract, or upon termination of the contract, the Contractor shall return all identification badges to the Contracting Officer or designee.

(13) INFORMATION AND PHYSICAL ACCESS SECURITY – Standard for Security

Configurations, HHSAR 352.239-70, (January 2010)

(a) The Contractor shall configure its computers that contain HHS data with the applicable

Federal Desktop Core Configuration (FDCC) (see http://nvd.nist.gov/fdcc/index.cfm) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level.

Note: FDCC is applicable to all computing systems using Windows XPTM and Windows VistaTM, including desktops and laptops - regardless of function - but not including servers.

(b) The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of HHS. The following security configuration requirements apply:

(c) The Contractor shall ensure IT applications operated on behalf of HHS are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings - see http://nvd.nist.gov/validation.cfm.

The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products met the latest FDCC major version and subsequent major versions.

(d) The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

(e) The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

(f) The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant (see http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf), Homeland Security Presidential Directive 12 (HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR Subpart 4.13, Personal Identity Verification.

(g) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

(14) INFORMATION AND PHYSICAL ACCESS SECURITY – Standard for Encryption language, HHSAR 352.239-71, (January 2010)

(a) The Contractor shall use Federal Information processing Standard (FIPS) 140-2-compliant encryption (Security) Requirements for Cryptographic Module, as amended) to protect all instances of HHS sensitive information during storage and transmission. (Note: The Government has determined that HHS information under this contract is considered "sensitive" in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004).

(b) The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Representative.

(c) The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf ). The Contractor shall notify the Contracting Officer and the Contracting Officer's Representative of personnel authorized to decrypt and recover all encrypted information.

(d) The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

(e) The Contractor shall ensure that this standard is incorporated into the Contractor's property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.

(f) The Contractor shall ensure that its subcontractors (all all tiers) which perform work under this contract comply with the requirements contained in this clause.

(15) INFORMATION AND PHYSICAL ACCESS SECURITY – Security Requirements For Federal

Information Technology Resources, HHSAR 352.239-72, (January 2010)

(a) Applicability. This clause applies whether the entire contract or order (hereafter "contract"), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term "information technology (IT)", as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

(b) Contractor responsibilities. The Contractor is responsible for the following:

1. Protecting Federal information and Federal information systems in order to ensure their –

a. Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

b. Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

c. Availability, which means ensuring timely and reliable access to and use of information.

2. Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS.

3. Adopting, and implementing, at a minimum, the policies, procedures, controls and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal information and Federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer's (OCIO) Web site.

(c) Contractor security deliverables. In accordance with the timeframes specified, the

Contractor shall prepare and submit the following security documents to the Contracting Officer for review, comment, and acceptance:

1. IT Security Plan (IT-SP) - due within 30 days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

a. The Contractor's IT-SP shall comply with applicable Federal laws that include, but are not limited to, the Federal Information Security Management Act (FISMA) of 2002 (Title III of the E-Government Act of 2002, Public Law 107-347), and the following Federal and HHS policies and procedures:

i. Office of Management and Budget (OMB) Circular A-130, Management of Federal

Information Resources, Appendix III, Security of Federal Automation Information Resources.

ii. National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-18, Guide for Developing Security Plans for Information Systems, in form and content, and with any pertinent contract Statement of Work/Performance Work Statement (SOW/PWS) requirements. The IT-SP shall identify and document appropriate IT security controls consistent with the sensitivity of the information and the requirements of Federal Information Processing Standard (FIPS) 200, Recommend Security Controls for Federal Information Systems. The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self- Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis.

iii. HHS-OCIO Information Systems Security and Privacy Policy.

2. IT Risk Assessment (IT-RA) - due within 30 days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft IT-RA, the Contracting Officer shall accept the IT-RA and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. The Contractor shall update the IT-RA on an annual basis.

3. FIPS 199 Standards for Security Categorization of Federal Information and

Information Systems Assessment (FIPS 199 Assessment) - due within 30 days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard. After resolution of any comments by the Government on the draft FIPS 199 Assessment, the Contracting Officer shall accept the FIPS 199 Assessment and incorporate the Contractor's final version into the contract.

4. IT Security Certification and Accreditation (IT-SC&A) - due within 3 months after contract award. The Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed for applicable information systems - see paragraph (a) of this clause. The Contractor shall perform the IT-SC&A in accordance with the HHS Chief Information Security Officer's Certification and Accreditation Checklist; NIST SP 800-37, Guide for the Security, Certification and Accreditation of Federal Information Systems; and NIST 800-53, Recommended Security Controls for Federal Information Systems. An authorized senior management official shall sign the draft IT-SC&A and provided it to the Contracting Officer for review, comment, and acceptance.

a. After resolution of any comments provided by the Government on the draft IT SC&A, the Contracting Officer shall accept the IT-SC&A and incorporate the Contractor's final version into the contract as a compliance requirement.

b. The Contractor shall also perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid. Evidence of a valid system accreditation includes written results of:

i. Annual testing of the system contingency plan; and

ii. The performance of security control testing and evaluation.

(d) Personal identity verification. The Contractor shall identify its employees with access to systems operated by the Contractor for HHS or connected to HHS systems and networks. The Contracting Officer's Representative (COR) shall identify, for those identified employees, position sensitivity levels that are commensurate with the responsibilities and risks associated with their assigned positions. The Contractor shall comply with the HSPD-12 requirements contained in "HHS-Controlled Facilities and Information Systems Security" requirements specified in the SOW/PWS of this contract.

(e) Contractor and subcontractor employee training. The Contractor shall ensure that its employees, and those of its subcontractors, performing under this contract complete HHS-furnished initial and refresher security and privacy education and awareness training before being granted access to systems operated by the Contractor on behalf of HHS or access to

HHS systems and networks. The Contractor shall provide documentation to the COR evidencing that Contractor employees have completed the required training.

(f) Government access for IT inspection. The Contractor shall afford the Government access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in performance of this contract to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of HHS data or to the protection of information systems operated on behalf of HHS.

(g) Subcontracts. The Contractor shall incorporate the substance of this clause in all subcontracts that require protection of Federal information and Federal information systems as described in paragraph (a) of this clause, including those subcontracts that –

1. Have physical or electronic access to HHS' computer systems, networks, or IT infrastructure; or

2. Use information systems to generate, store, process, or exchange data with HHS or on behalf of HHS, regardless of whether the data resides on a HHS or the Contractor's information system.

(h) Contractor employment notice. The Contractor shall immediately notify the Contracting

Officer when an employee either begins or terminates employment (or is no longer assigned to the HHS project under this contract), if that employee has, or had, access to HHS information systems or data.

(i) Document information. The Contractor shall contact the Contracting Officer for any documents, information, or forms necessary to comply with the requirements of this clause.

(j) Contractor responsibilities upon physical completion of the contract. The Contractor shall return all HHS information and IT resources provided to the Contractor during contract performance and certify that all HHS information has been purged from Contractor-owned systems used in contract performance.

(k) Failure to comply. Failure on the part of the Contractor or its subcontractors to comply with the terms of this clause shall be grounds for the Contracting Officer to terminate this contract.

Note: The NIST Special Publication SP-800-26 cited in subparagraph c.1.a.(ii) of this clause has been superseded by NIST SP 800-53A, "Guide for Assessing the Security Controls in Federal Information Systems and Organizations" for use for the assessment of security control effectiveness. See http://csrc.nist.gov/publications/PubsSPs.html to access NIST Special Publications (800 Series).

(16) INFORMATION AND PHYSICAL ACCESS SECURITY – SECURITY CATEGORIZATION OF

FEDERAL INFORMATION AND INFORMATION SYSTEMS (FIPS 199 Assessment)

(a) Information Type:

[ ] Administrative, Management and Support Information:

[X] Mission Based Information:

(b) Security Categories and Levels:

Confidentiality Level: [ ] Low [X] Moderate [ ] High Integrity Level: [ ] Low [X] Moderate [ ] High Availability Level: [X] Low [ ] Moderate [ ] High http://csrc.nist.gov/publications/PubsSPs.html

Overall Level: [ ] Low [X] Moderate [ ] High

(c) In accordance with HHSAR Clause 352.239-72, the contractor shall submit a FIPS 199 Assessment within 30 days after contract award. Any differences between the contractor's assessment and the information contained herein will be resolved, and if required, the contract will be modified to incorporate the final FIPS 199 Assessment.

(17) INFORMATION AND PHYSICAL ACCESS SECURITY – INFORMATION SECURITY TRAINING

In addition to any training covered under paragraph (e) of HHSAR 352.239-72, the contractor shall comply with the below training:

(a) Mandatory Training

1. All Contractor employees having access to (1) Federal information or a Federal information system or (2) sensitive data/information as defined at HHSAR 304.1300(a)(4), shall complete the NIH Computer Security Awareness Training course at http://irtsectraining.nih.gov/ before performing any work under this contract. Thereafter, Contractor employees having access to the information identified above shall complete an annual NIH-specified refresher course during the life of this contract. The Contractor shall also ensure subcontractor compliance with this training requirement.

2. The Contractor shall maintain a listing by name and title of each Contractor / Subcontractor employee working on this contract and having access of the kind in paragraph 1.a(1) above, who has completed the NIH required training. Any additional security training completed by the Contractor/Subcontractor staff shall be included on this listing. The list shall be provided to the COR and/or Contracting Officer upon request.

(b) Role-based Training

HHS requires role-based training when responsibilities associated with a given role or position, could, upon execution, have the potential to adversely impact the security posture of one or more HHS systems. Read further guidance at Secure One HHS Memorandum on Role-Based Training Requirement.

For additional information see the following: https://ocio.nih.gov/InfoSecurity/Policy/Documents/Final- InfoSecAwarenessTrainPol.doc

The Contractor shall maintain a list of all information security training completed by each contractor/subcontractor employee working under this contract. The list shall be provided to the COR and/or Contracting Officer upon request.

(c) Rules of Behavior The Contractor shall ensure that all employees, including subcontractor employees, comply with the NIH Information Technology General Rules of Behavior (https://ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx ), which are contained in the NIH Information Security Awareness Training Course http://irtsectraining.nih.gov.

(18) INFORMATION AND PHYSICAL ACCESS SECURITY – PERSONNEL SECURITY

RESPONSIBILITIES

In addition to any personnel security responsibilities covered under HHSAR 352.239-72, the contractor shall comply with the below personnel security responsibilities:

(a) In accordance with Paragraph (h) of HHSAR 352.239-72, the Contractor shall notify the

Contracting officer and the COR within five working days before a new employee assumes a position that requires access to HHS information systems or data, or when an employee with such access stops working on this contract. The Government will initiate a background https://ocio.nih.gov/InfoSecurity/Policy/Documents/Final-InfoSecAwarenessTrainPol.doc https://ocio.nih.gov/InfoSecurity/Policy/Documents/Final-InfoSecAwarenessTrainPol.doc https://ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx http://irtsectraining.nih.gov/ investigation on new employees assuming a position that requires access to HHS information systems or data, and will stop pending background investigations for employees that no longer work under the contract or no longer have such access.

(b) New contractor employees who have or will have access to HHS information systems or data: The Contractor shall provide the COR with the name, position title, e-mail address, and phone number of all new contract employees working under the contract and provide the name, position title and position sensitivity level held by the former incumbent. If an employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate position sensitivity level.

(c) Departing contractor employees: The Contractor shall provide the COR with the name, position title, and position sensitivity level held by or pending for departing employees. The Contractor shall perform and document the actions identified in the Contractor Employee Separation Checklist https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf ) when a Contractor/subcontractor employee terminates work under this contract.

All documentation shall be made available to the COR upon request.

(d) Commitment to Protect Non-Public Departmental Information and Data.

The Contractor, and any subcontractors performing under this contract, shall not release, publish, or disclose non-public Departmental information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

- 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

- 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

- Public Law 96-511 (Paperwork Reduction Act)

Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the "Commitment to Protect Non-Public Information - Contractor Employee Agreement" located at: https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf .

A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer/COR prior to performing any work under this acquisition.

(19) INFORMATION AND PHYSICAL ACCESS SECURITY – LOSS AND/OR BREACH OF

PERSONALLY IDENTIFIABLE INFORMATION (PII) NOTIFICATION OF DATA REACH

Loss and/or Disclosure of Personally Identifiable Information (PII) - Notification of Data Breach

The Contractor shall report all suspected or confirmed incidents involving the loss and/or disclosure of PII in electronic or physical form. Notification shall be made to the NIH Incident Response Team (IRT) via email (IRT@mail.nih.gov) within one hour of discovering the incident.

The Contractor shall follow up with IRT by completing and submitting one of the applicable two forms below within three (3) work days of incident discovery:

NIH PII Spillage Report at: https://ocio.nih.gov/InfoSecurity/Policy/Documents/NIH_PII_Spillage_Proced.doc

NIH Lost or Stolen Assets Report at: https://ocio.nih.gov/InfoSecurity/Policy/Documents/ISSO_Stolen_Device- Media_Handling_Procedures.doc https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/InfoSecurity/Policy/Documents/NIH_PII_Spillage_Proced.doc https://ocio.nih.gov/InfoSecurity/Policy/Documents/ISSO_Stolen_Device-Media_Handling_Procedures.doc https://ocio.nih.gov/InfoSecurity/Policy/Documents/ISSO_Stolen_Device-Media_Handling_Procedures.doc

(20) INFORMATION AND PHYSICAL ACCESS SECURITY – VULNERABILITY SCANNING

REQUIREMENTS

This acquisition requires the Contractor to host an NIH webpage or database. The Contractor shall conduct periodic and special vulnerability scans, and install software/hardware patches and upgrades to protect automated federal information assets. The minimum requirement shall be to protect against vulnerabilities identified on the SANS Top-20 Internet Security Attack Targets list (http://www.sans.org/top20/?ref=3706#w1). The Contractor shall report the results of these scans to the Project Officer/COR on a monthly basis, with reports due 10 calendar days following the end of each reporting period. The Contractor shall ensure that all of its subcontractors (at all tiers), where applicable, comply with the above requirements.

(21) Electronic and Information Technology Accessibility, HHSAR 352.239-73(a) (January 2010)

“Electronic and Information Technology Accessibility, Section 508 Compliance is applicable to this solicitation and the following information is provided to assist in proposal preparation”

IMPORTANT NOTE TO OFFERORS: The following information shall be addressed in a separate section of the Technical Proposal, entitled, "Section 508 Compliance."

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce

Investment Act of 1998, and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that, unless an exception applies, all EIT products and services developed, acquired, maintained, or used by any Federal department or agency permit—

1. Federal employees with disabilities to have access to and use information and data that is comparable to the access and use of information and data by Federal employees who are not individuals with disabilities; and

2. Members of the public with disabilities seeking information or services from a Federal agency to have access to and use of information and data that is comparable to the access and use of information and data by members of the public who are not individuals with disabilities.

(b) Accordingly, any vendor submitting a proposal/quotations/bid in response to this solicitation must demonstrate compliance with the established EIT accessibility standards. Information about Section 508 visions is available at http://www.section508.gov/ . The complete text of Section 508 Final Provisions can be accessed at http://www.access-board.gov/guidelines-and-standards .

(c) The Section 508 accessibility standards applicable to this solicitation are identified in the Statement of Work/Specification/Performance Work Statement. In order to facilitate the Government's evaluation to determine whether EIT products and services proposed meet applicable Section 508 accessibility standards, offerors must prepare an HHS Section 508 Product Assessment Template, in accordance with its completion instructions, and provide a binding statement of conformance. The purpose of the template is to assist HHS acquisition and program officials in determining that EIT products and services proposed support applicable Section 508 accessibility standards. The template allows vendors or developers to self-evaluate their products or services and document in detail how they do or do not conform to a specific Section 508 standard. Instructions for preparing the HHS Section 508 Product Evaluation Template may be found on the HHS Web site ( http://www.hhs.gov/web/508/contracting/technology/vendors.html ).

(d) Respondents to this solicitation must also provide any additional detailed information necessary for determining applicable Section 508 standards conformance, as well as for documenting EIT products or services that are incidental to the project, which would constitute http://www.section508.gov/ http://www.access-board.gov/sec508/provisions.htm http://www.access-board.gov/guidelines-and-standards http://www.hhs.gov/web/508/contracting/technology/vendors.html an exception to Section 508 requirements. If a vendor claims its products or services, including EIT deliverables such as electronic documents and reports, meet applicable Section 508 accessibility standards in its completed HHS Section 508 Product Assessment Template, and it is later determined by the Government -- i.e., after award of a contract/order, that products or services delivered do not conform to the described accessibility standards in the Product Assessment Template, remediation of the products or services to the level of conformance specified in the vendor's Product Assessment Template will be the responsibility of the Contractor and at its expense. (End of provision)

The "HHS Section 508 Product Assessment Template" may be found at the following Web site http://www.hhs.gov/web/508/contracting/technology/vpatinstructions.doc

(22) ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY, HHSAR 352.239-73(b) (January 2010)

(a) Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all electronic and information technology (EIT) products and services developed, acquired, maintained, or used under this contract/order must comply with the "Electronic and Information Technology Accessibility Provisions" set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the "Access Board") in 36 CFR part 1194. Information about Section 508 provisions is available at http://www.section508.gov/ . The complete text of Section 508 Final provisions can be accessed at http://www.access-board.gov/guidelines-and-standards .

(b) The Section 508 standards applicable to this contract/order are identified in the [Statement of Work/Specification/Performance Work Statement] . The contractor must provide a written Section 508 conformance certification due at the end of each contract/order exceeding $100,000 when the contract/order duration is one year or less. If it is determined by the Government that EIT products and services provided by the Contractor do not conform to the described accessibility standards in the Product Assessment Template, remediation of the products or services to the level of conformance specified in the Contractor's Product Assessment Template will be the responsibility of the Contractor at its own expense.

(c) In the event of a modification(s) to this contract/order, which adds new EIT products or services or revises the type of, or specifications for, products or services the Contractor is to provide, including EIT deliverables such as electronic documents and reports, the Contracting Officer may require that the contractor submit a completed HHS Section 508 Product Assessment Template to assist the Government in determining that the EIT products or services support Section 508 accessibility standards. Instructions for documenting accessibility via the HHS Section 508 Product Assessment Template may be found on the HHS Web site ( http://www.hhs.gov/web/508/contracting/technology/vendors.html ).

[(End of HHSAR 352.239-73(b)]

(d) Prior to the Contracting Officer exercising an option for a subsequent performance period/additional quantity or adding funding for a subsequent performance period under this contract, as applicable, the Contractor must provide a Section 508 Annual Report to the Contracting Officer and Project Officer. Unless otherwise directed by the Contracting Officer in writing, the Contractor shall provide the cited report in accordance with the following schedule. Instructions for completing the report are available in the Section 508 policy on the HHS Office on Disability Web site under the heading Vendor Information and Documents. The Contractor's failure to submit a timely and properly completed report may jeopardize the Contracting Officer's exercising an option or adding funding, as applicable.

Schedule for Contractor Submission of Section 508 Annual Report:

[End of HHSAR 352.239-73(c)] http://www.hhs.gov/web/508/contracting/technology/vpatinstructions.doc http://www.section508.gov/ http://www.access-board.gov/guidelines-and-standards

(23) Section 508 accessibility standards for HHS Web Site Content and Communications

Materials

(a) Regardless of format, all Web content or communications materials specifically produced for publication on, or delivery via, HHS Web sites, including text, audio, or video, under this contract shall conform to applicable Section 508 accessibility standards. Remediation of any materials that do not comply with the applicable accessibility standards of 36 CFR Part 1194 as set forth herein shall be the responsibility of the Contractor.

(b) The following Section 508 accessibility standards apply to the…